1*0Sstevel@tonic-gate /*
2*0Sstevel@tonic-gate * Copyright (C) 1993-2001 by Darren Reed.
3*0Sstevel@tonic-gate *
4*0Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing.
5*0Sstevel@tonic-gate *
6*0Sstevel@tonic-gate * $Id: ipft_sn.c,v 1.7 2003/02/16 02:32:36 darrenr Exp $
7*0Sstevel@tonic-gate */
8*0Sstevel@tonic-gate
9*0Sstevel@tonic-gate /*
10*0Sstevel@tonic-gate * Written to comply with the recent RFC 1761 from Sun.
11*0Sstevel@tonic-gate */
12*0Sstevel@tonic-gate #include "ipf.h"
13*0Sstevel@tonic-gate #include "snoop.h"
14*0Sstevel@tonic-gate #include "ipt.h"
15*0Sstevel@tonic-gate
16*0Sstevel@tonic-gate #if !defined(lint)
17*0Sstevel@tonic-gate static const char rcsid[] = "@(#)$Id: ipft_sn.c,v 1.7 2003/02/16 02:32:36 darrenr Exp $";
18*0Sstevel@tonic-gate #endif
19*0Sstevel@tonic-gate
20*0Sstevel@tonic-gate struct llc {
21*0Sstevel@tonic-gate int lc_sz; /* LLC header length */
22*0Sstevel@tonic-gate int lc_to; /* LLC Type offset */
23*0Sstevel@tonic-gate int lc_tl; /* LLC Type length */
24*0Sstevel@tonic-gate };
25*0Sstevel@tonic-gate
26*0Sstevel@tonic-gate /*
27*0Sstevel@tonic-gate * While many of these maybe the same, some do have different header formats
28*0Sstevel@tonic-gate * which make this useful.
29*0Sstevel@tonic-gate */
30*0Sstevel@tonic-gate static struct llc llcs[SDL_MAX+1] = {
31*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_8023 */
32*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_8024 */
33*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_8025 */
34*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_8026 */
35*0Sstevel@tonic-gate { 14, 12, 2 }, /* SDL_ETHER */
36*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_HDLC */
37*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_CHSYNC */
38*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_IBMCC */
39*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_FDDI */
40*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_OTHER */
41*0Sstevel@tonic-gate };
42*0Sstevel@tonic-gate
43*0Sstevel@tonic-gate static int snoop_open __P((char *));
44*0Sstevel@tonic-gate static int snoop_close __P((void));
45*0Sstevel@tonic-gate static int snoop_readip __P((char *, int, char **, int *));
46*0Sstevel@tonic-gate
47*0Sstevel@tonic-gate static int sfd = -1, s_type = -1;
48*0Sstevel@tonic-gate static int snoop_read_rec __P((struct snooppkt *));
49*0Sstevel@tonic-gate
50*0Sstevel@tonic-gate struct ipread snoop = { snoop_open, snoop_close, snoop_readip, 0 };
51*0Sstevel@tonic-gate
52*0Sstevel@tonic-gate
snoop_open(fname)53*0Sstevel@tonic-gate static int snoop_open(fname)
54*0Sstevel@tonic-gate char *fname;
55*0Sstevel@tonic-gate {
56*0Sstevel@tonic-gate struct snoophdr sh;
57*0Sstevel@tonic-gate int fd;
58*0Sstevel@tonic-gate int s_v;
59*0Sstevel@tonic-gate
60*0Sstevel@tonic-gate if (sfd != -1)
61*0Sstevel@tonic-gate return sfd;
62*0Sstevel@tonic-gate
63*0Sstevel@tonic-gate if (!strcmp(fname, "-"))
64*0Sstevel@tonic-gate fd = 0;
65*0Sstevel@tonic-gate else if ((fd = open(fname, O_RDONLY)) == -1)
66*0Sstevel@tonic-gate return -1;
67*0Sstevel@tonic-gate
68*0Sstevel@tonic-gate if (read(fd, (char *)&sh, sizeof(sh)) != sizeof(sh))
69*0Sstevel@tonic-gate return -2;
70*0Sstevel@tonic-gate
71*0Sstevel@tonic-gate s_v = (int)ntohl(sh.s_v);
72*0Sstevel@tonic-gate s_type = (int)ntohl(sh.s_type);
73*0Sstevel@tonic-gate
74*0Sstevel@tonic-gate if (s_v != SNOOP_VERSION ||
75*0Sstevel@tonic-gate s_type < 0 || s_type > SDL_MAX) {
76*0Sstevel@tonic-gate (void) close(fd);
77*0Sstevel@tonic-gate return -2;
78*0Sstevel@tonic-gate }
79*0Sstevel@tonic-gate
80*0Sstevel@tonic-gate sfd = fd;
81*0Sstevel@tonic-gate printf("opened snoop file %s:\n", fname);
82*0Sstevel@tonic-gate printf("\tid: %8.8s version: %d type: %d\n", sh.s_id, s_v, s_type);
83*0Sstevel@tonic-gate
84*0Sstevel@tonic-gate return fd;
85*0Sstevel@tonic-gate }
86*0Sstevel@tonic-gate
87*0Sstevel@tonic-gate
snoop_close()88*0Sstevel@tonic-gate static int snoop_close()
89*0Sstevel@tonic-gate {
90*0Sstevel@tonic-gate return close(sfd);
91*0Sstevel@tonic-gate }
92*0Sstevel@tonic-gate
93*0Sstevel@tonic-gate
94*0Sstevel@tonic-gate /*
95*0Sstevel@tonic-gate * read in the header (and validate) which should be the first record
96*0Sstevel@tonic-gate * in a snoop file.
97*0Sstevel@tonic-gate */
snoop_read_rec(rec)98*0Sstevel@tonic-gate static int snoop_read_rec(rec)
99*0Sstevel@tonic-gate struct snooppkt *rec;
100*0Sstevel@tonic-gate {
101*0Sstevel@tonic-gate int n, plen, ilen;
102*0Sstevel@tonic-gate
103*0Sstevel@tonic-gate if (read(sfd, (char *)rec, sizeof(*rec)) != sizeof(*rec))
104*0Sstevel@tonic-gate return -2;
105*0Sstevel@tonic-gate
106*0Sstevel@tonic-gate ilen = (int)ntohl(rec->sp_ilen);
107*0Sstevel@tonic-gate plen = (int)ntohl(rec->sp_plen);
108*0Sstevel@tonic-gate if (ilen > plen || plen < sizeof(*rec))
109*0Sstevel@tonic-gate return -2;
110*0Sstevel@tonic-gate
111*0Sstevel@tonic-gate plen -= sizeof(*rec);
112*0Sstevel@tonic-gate n = MIN(plen, ilen);
113*0Sstevel@tonic-gate if (!n || n < 0)
114*0Sstevel@tonic-gate return -3;
115*0Sstevel@tonic-gate
116*0Sstevel@tonic-gate return plen;
117*0Sstevel@tonic-gate }
118*0Sstevel@tonic-gate
119*0Sstevel@tonic-gate
120*0Sstevel@tonic-gate #ifdef notyet
121*0Sstevel@tonic-gate /*
122*0Sstevel@tonic-gate * read an entire snoop packet record. only the data part is copied into
123*0Sstevel@tonic-gate * the available buffer, with the number of bytes copied returned.
124*0Sstevel@tonic-gate */
snoop_read(buf,cnt)125*0Sstevel@tonic-gate static int snoop_read(buf, cnt)
126*0Sstevel@tonic-gate char *buf;
127*0Sstevel@tonic-gate int cnt;
128*0Sstevel@tonic-gate {
129*0Sstevel@tonic-gate struct snooppkt rec;
130*0Sstevel@tonic-gate static char *bufp = NULL;
131*0Sstevel@tonic-gate int i, n;
132*0Sstevel@tonic-gate
133*0Sstevel@tonic-gate if ((i = snoop_read_rec(&rec)) <= 0)
134*0Sstevel@tonic-gate return i;
135*0Sstevel@tonic-gate
136*0Sstevel@tonic-gate if (!bufp)
137*0Sstevel@tonic-gate bufp = malloc(i);
138*0Sstevel@tonic-gate else
139*0Sstevel@tonic-gate bufp = realloc(bufp, i);
140*0Sstevel@tonic-gate
141*0Sstevel@tonic-gate if (read(sfd, bufp, i) != i)
142*0Sstevel@tonic-gate return -2;
143*0Sstevel@tonic-gate
144*0Sstevel@tonic-gate n = MIN(i, cnt);
145*0Sstevel@tonic-gate bcopy(bufp, buf, n);
146*0Sstevel@tonic-gate return n;
147*0Sstevel@tonic-gate }
148*0Sstevel@tonic-gate #endif
149*0Sstevel@tonic-gate
150*0Sstevel@tonic-gate
151*0Sstevel@tonic-gate /*
152*0Sstevel@tonic-gate * return only an IP packet read into buf
153*0Sstevel@tonic-gate */
snoop_readip(buf,cnt,ifn,dir)154*0Sstevel@tonic-gate static int snoop_readip(buf, cnt, ifn, dir)
155*0Sstevel@tonic-gate char *buf, **ifn;
156*0Sstevel@tonic-gate int cnt, *dir;
157*0Sstevel@tonic-gate {
158*0Sstevel@tonic-gate static char *bufp = NULL;
159*0Sstevel@tonic-gate struct snooppkt rec;
160*0Sstevel@tonic-gate struct llc *l;
161*0Sstevel@tonic-gate char ty[4], *s;
162*0Sstevel@tonic-gate int i, n;
163*0Sstevel@tonic-gate
164*0Sstevel@tonic-gate do {
165*0Sstevel@tonic-gate if ((i = snoop_read_rec(&rec)) <= 0)
166*0Sstevel@tonic-gate return i;
167*0Sstevel@tonic-gate
168*0Sstevel@tonic-gate if (!bufp)
169*0Sstevel@tonic-gate bufp = malloc(i);
170*0Sstevel@tonic-gate else
171*0Sstevel@tonic-gate bufp = realloc(bufp, i);
172*0Sstevel@tonic-gate s = bufp;
173*0Sstevel@tonic-gate
174*0Sstevel@tonic-gate if (read(sfd, s, i) != i)
175*0Sstevel@tonic-gate return -2;
176*0Sstevel@tonic-gate
177*0Sstevel@tonic-gate l = &llcs[s_type];
178*0Sstevel@tonic-gate i -= l->lc_to;
179*0Sstevel@tonic-gate s += l->lc_to;
180*0Sstevel@tonic-gate /*
181*0Sstevel@tonic-gate * XXX - bogus assumption here on the part of the time field
182*0Sstevel@tonic-gate * that it won't be greater than 4 bytes and the 1st two will
183*0Sstevel@tonic-gate * have the values 8 and 0 for IP. Should be a table of
184*0Sstevel@tonic-gate * these too somewhere. Really only works for SDL_ETHER.
185*0Sstevel@tonic-gate */
186*0Sstevel@tonic-gate bcopy(s, ty, l->lc_tl);
187*0Sstevel@tonic-gate } while (ty[0] != 0x8 && ty[1] != 0);
188*0Sstevel@tonic-gate
189*0Sstevel@tonic-gate i -= l->lc_tl;
190*0Sstevel@tonic-gate s += l->lc_tl;
191*0Sstevel@tonic-gate n = MIN(i, cnt);
192*0Sstevel@tonic-gate bcopy(s, buf, n);
193*0Sstevel@tonic-gate
194*0Sstevel@tonic-gate return n;
195*0Sstevel@tonic-gate }
196